Php File Manager With Code Editor
Monthly
Unrestricted file upload in JosephChuks php-file-manager-with-code-editor through version 3.0 lets remote attackers write attacker-controlled files, including executable PHP, to the server by manipulating the filename and content arguments passed to file_put_contents in codeEditor.php's Save Handler, which can result in remote code execution wherever the write target is web-servable. The vendor's CVSS 4.0 vector indicates an unauthenticated attack (PR:N/UI:N) against the affected component, though file-manager and code-editor front ends are commonly placed behind an application login, in which case a valid session or credentials could be the real limiting factor. Publicly available exploit code exists (the disclosure was made public, and the vendor was contacted about it but did not respond); there is no CISA KEV listing and no EPSS score was provided, and the product has negligible real-world deployment.
Unrestricted file upload in JosephChuks php-file-manager-with-code-editor through 3.0 lets an attacker with low privileges upload arbitrary files via the move_uploaded_file call in filemanager.php, potentially achieving PHP code execution if the uploaded file lands in a web-executable directory. The flaw is CWE-434 and carries an upstream CVSS 4.0 score of 6.9, while the independent CVSS 3.1 assessment rates PR:L with high confidentiality/integrity/availability impact and cautions that reachability without authentication and final execution location are unconfirmed. No public exploit code has been identified, and the vendor did not respond to disclosure.
Unrestricted file upload in JosephChuks php-file-manager-with-code-editor through version 3.0 lets remote attackers write attacker-controlled files, including executable PHP, to the server by manipulating the filename and content arguments passed to file_put_contents in codeEditor.php's Save Handler, which can result in remote code execution wherever the write target is web-servable. The vendor's CVSS 4.0 vector indicates an unauthenticated attack (PR:N/UI:N) against the affected component, though file-manager and code-editor front ends are commonly placed behind an application login, in which case a valid session or credentials could be the real limiting factor. Publicly available exploit code exists (the disclosure was made public, and the vendor was contacted about it but did not respond); there is no CISA KEV listing and no EPSS score was provided, and the product has negligible real-world deployment.
Unrestricted file upload in JosephChuks php-file-manager-with-code-editor through 3.0 lets an attacker with low privileges upload arbitrary files via the move_uploaded_file call in filemanager.php, potentially achieving PHP code execution if the uploaded file lands in a web-executable directory. The flaw is CWE-434 and carries an upstream CVSS 4.0 score of 6.9, while the independent CVSS 3.1 assessment rates PR:L with high confidentiality/integrity/availability impact and cautions that reachability without authentication and final execution location are unconfirmed. No public exploit code has been identified, and the vendor did not respond to disclosure.